CVE-2026-32713: PX4 Autopilot MAVLink FTP Session Validation Logic Error Allows Operations on Invalid File Descriptors
PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, A logic error in the PX4 Autopilot MAVLink FTP session validation uses incorrect boolean logic (&& instead of ||), allowing BurstReadFile and WriteFile operations to proceed with invalid sessions or closed file descriptors. This enables an unauthenticated attacker to put the FTP subsystem into an inconsistent state, trigger operations on invalid file descriptors, and bypass session isolation checks. This vulnerability is fixed in 1.17.0-rc2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32713?
CVE-2026-32713 is classified as a high severity vulnerability due to its potential to allow unauthorized operations on invalid file descriptors in PX4 autopilot systems.
How do I fix CVE-2026-32713?
To mitigate CVE-2026-32713, update your PX4 Autopilot software to version 1.17.0-rc2 or later.
What systems are affected by CVE-2026-32713?
CVE-2026-32713 affects all versions of the PX4 Autopilot prior to 1.17.0-rc2.
What type of vulnerability is CVE-2026-32713?
CVE-2026-32713 is a logic error vulnerability in the MAVLink FTP session validation of the PX4 autopilot.
Can CVE-2026-32713 be exploited remotely?
Yes, CVE-2026-32713 can be exploited remotely, allowing attackers to perform unauthorized operations on the autopilot.